Fortinet Community

Hi,Anyone have any news around arm64 windows collector support?Best Regards,/R.FortiEDR 

Azure Virtual FortiGate dropped SR-IOV Accelerated Networking interfaces Port1, Port2, Port3, Port4.More than 50 IPsec tunnels down & came up after restart.  System Events logs device port1 loses a SR-IOV slave device sriovslv2.Hyper-V SR-IOV VF secondary is hot unpluggedI raised a ticket with Microsoft & Fortinet for RCA.  Can someone helps me to understand root cause & prevent this issue for future.

In my test environment, I migrated from FortiEMS client 7.2.2 to 7.4.4.We deployed EMS on a Hyper-V VM.I didn't encounter any issues during the migration.I want to start the console now, but I'm getting the error below.I think it has something to do with the certificate, among other things.How can I remove it and/or configure/import a new certificate?

Configuration detailsMode :Transparent Mode Interface setting: Port x1 (internal), Port x2 (External). All traffic from the inside network passes through port x1 to port x2 to reach the internet. I upgraded the FortiOS version on a FortiGate 401F from 7.4.9 to 7.4.11. After the upgrade, users were unable to access services properly. Specifically: -Internal users were unable to access the Internet.-External users were unable to access the web server located behind the FortiGate. From initial traffic log analysis, I observed that packets were being sent out to the external network, but no return packets were received. Due to limited maintenance time and business impact, I rolled back the FortiOS version to 7.4.9. After the rollback, all services returned to normal operation. Has anyone experienced this issue with FortiOS 7.4.11? Currently, I have opened a ticket with Fortinet Support, but there has been no update yet. Thank you.

Hello everyone, In a Fortinet FortiAnalyzer VM environment, we are frequently seeing the alert:[Your daily logs GB/day limit is exceeded within the last 7 days]I would like to hear from the community about real-world impacts when the daily log ingestion limit is exceeded.Have you experienced log loss, delayed indexing, or incomplete reports?Any noticeable performance impact or issues with analytics and event correlation?  Note: I am fully aware that the daily gigabyte allowance is quite low and I am willing to upgrade the license, I just wanted to know what I might be compromising on my analyzer. 

Hello, I am looking for a solution how to use firewall objects from one ADOM in another one.Is there a possibility to share objects?Or is it possible to export the objects database and import it in the other ADOM? regardsRainer

I love how easy it is to create «advanced» address objects like fqdn, GeoIP and even wildcard fqdn (actually usually works). And I’m a heavy user of either fqdn or GeoIp as source address on all inbound policies.However I wish there was an easy way of creating ASN ad a address object.There is a possibility to create ASN textfiles and host yourself with python script, using them with a fabric connector.But I wish there was an easier way.Do you know of a easy way of getting ASN as a address object? What other address objects do you miss as a daily runner of a FortiOs device?

I'm spinning up a new pair of FortiGate 901G's to replace some Cisco FTD's (yuck!). I'm very used to and appreciative of Palo's way of doing security policy, centralized NAT, and a separate decryption policy. I like being able to make security policy directly based on app or URL category, rather than making profiles for everything. I don't see how profile mode is as flexible as policy mode. If I want to make a policy for a single app to be let through, I can't do that with profile mode, as an app control profile allows and denies all apps. For example, say I want to allow the "Quickbooks" app. I can't make a policy that has an app control profile of just allowing Quickbooks.. The app control policy would either end up blocking or allowing all apps. This is where i see the biggest downside to profile mode.I've spoken to a few people I respect in the Fortinet world, and they recommended staying with Profile mode for varying reasons...- I heard there is less support for Policy-based mode-

Hello all, I have configured Remote IPsec VPN to access internal network, am using FortiClient.For User authentication I am using Radius server which is configured at Windows Server (NPS).Also users are authenticating & getting IP address from Radius Server. (without 2FA Email based) When I use 2FA with email based - What problem I am facing while accessing the VPN--------->---> Getting token twiceRefer to the config:-config user localedit testtype Radiusset two-factor emailset email-to abc@gmail.comAt that time I am getting email token twice. FYI - I am using IKE version 2 ... ( For Fortigate IPsec tunnel)config vpn ipsec phase1-interfaceset type dynamicset interface "port1"set ip-version 4set ike-version 2set authmethod pskset mode-cfg enableset eap enableset eap-identity send-requestset authusrgrp (Test Group)set assign-ip enableset assign-ip-from group ( test)  Anyone has any Idea why I am getting token twice over email. I have put effort a lot bu

I have a few branch offices running FG100s, and I set up DHCP on them since they are small. I point DNS back at the AD servers at the main office. Everything seems to be working, but there are not PTR records in the reverse lookup.Some googling has led me to try a few things that didn't work. So I turn here for guidance. Am I missing something?

Hi all,  What would be the best way to migrate fortiswitch/AP management to Fortilink from FortiEdge/FortiLAN? I was thinking of resetting the configurations on the switch and turning on the security fabric connection on the uplink interface -- when I set up the switches, I changed the LLDP settings and turned off fortilink discovery off.   Thank you! C 

We are currently using a Next-Generation Firewall 201G running on FortiOS 7.4.11. The firewall is connected to the ISP LAN port, and the ISP firewall has a DMZ configured towards our firewall, with all required ports forwarded to it. We attempted to configure both SSL VPN and IPsec Dial-up VPN; however, neither of them is working. We have thoroughly verified the configuration, and all required policies are correctly in place. I have also followed the official Fortinet documentation step by step to troubleshoot the issue, but the problem still persists. Administrative access via HTTPS is enabled on the WAN interface, and Dynamic DNS is correctly resolving to the ISP public IP address. However, the firewall is not accessible from the public internet. Since the firewall itself is not reachable externally, SSL VPN communication is also failing. This situation is extremely frustrating. Even Fortinet support has not been helpful so far—they are repeatedly requesting logs, but

Hello everyone,We are currently running several Windows Server 2016 systems (Extended Support until January 12, 2027) using FortiClient 7.2.9.1185. Since this version contains known vulnerabilities, we would like to update to a newer release. Unfortunately, newer FortiClient versions no longer support Windows Server 2016.We are looking for advice and would love to hear from the community:- How are you securing Windows Server 2016 systems with FortiClient?- Are there specific workarounds, additional hardening steps, or complementary security solutions you use?- Do you continue to run FortiClient on Server 2016 despite the lack of official support, or have you adopted alternative approaches?Any experiences, best practices, or recommendations would be highly appreciated! Thank you in advance for your input.

I try to connect Fortigate-VM (v7.4.11 build2878) to Fortimanager VM (v7.6.6 build3654) both of them have trial licenses in the same account. If I try to connect from Fortigate side I get error "The FortiManager's access to the FortiGate will be authenticated by the FortiManager certificate. The serial number from the certificate must match the serial number observed on the FortiManager. Could not connect to the FortiManager to retrieve its serial number."  If I try to connect from Fortimanager as discover online device I get error "Probe failed" after Fortigates login and password entering. Both VMs placed in the same subnet and have fresh installation and only one configured interface and have internet access. FMG-Access enabled on Fortigate's interface.On FortiManager side I configure the follow:"FMG-VM64 # config system global(global)# showconfig system globalset adom-rev-auto-delete disableset enc-algorithm lowset fgfm-allow-vm enableset fgfm-ssl

Is there any good courses for FCP – Network Security (FortiGate Admin) that’s hands on out there? I’m not studying for the certification, I just want to learn it. I passed the CCNA Exam certification like 1 month ago, been doing a lot of labs, and I’m comfortable working on EVE NG. So, I want to challenge myself and start working with firewall instead ACL

We recently introduced iOS clients to our fleet, unfortunately FortiVPN with sslvpn seems to not set DNS server on iOS since our internal stuff won't resolve. Works fine on Android though.

Hello,I have two FortiGates (Site 1 & Site 3) connected via two GRE overlays:GRE_DC1_S3_AS20 – latency: 0.39ms, packet loss: 0%, jitter: 0.05msGRE_DC1_S3_SP5 – latency: 35.15ms, packet loss: 0%, jitter: 2.79msI configured SD-WAN between the two sites.Test scenario:Site 1: 172.16.213.2Site 3: 172.16.233.31. Best-effort / untagged trafficSD-WAN rule: Best Quality, latency criterionTraffic correctly uses AS20When AS20 degrades, traffic fails over to SP5 → works as expectedAfter this test, I modified the SD-WAN rule for untagged traffic:Strategy: ManualPreferred interface: SP5Observed behavior:Untagged traffic correctly goes via SP5 (as intended)2. Classified traffic (CS6) SD-WAN ruleNetwork Control for CS6 class trafficStrategy: Best QualityCriteria: LatencyProtocol specification:Protocol number: 0Type of Service (TOS): 0xc0Bit mask: 0xffTest ping from 172.16.233.2 :ping -s 600 -c 100 -D -Q 0xc0 172.16.213.2Expected behavior:Traffic should use AS20 because latency (0.39ms) is well bel

Hi All, So have some MacBooks with sometimes this message, but wifi is still running, no ip change or whatever. 1 - Why this messages? (How can I find out why this is happening)2 - How to disable them? Any ideas?ThanksFortinac Persistant Agent v10.7.2.13Connected with FortiAP 

My team has been deploying a lot of SDWan lately with DIA and Broadband circuits. We have a couple of sites that have frequently been reporting session disconnects from cloud hosted applications and SIP phones that suddenly lose audio. I asked the sites to start reporting the exact times so I could correlate their issues to events in the logs. So far, each reported event seems to correlate to SDWan changes. Digging in deeper, neither of the circuits seem to be dropping, just falling outside the defined SLA values. Each time it was reported, I checked the active sessions on the firewall for the impacted phones and saw the destination interface being used didn't match the interface SDWan was preferring at the time.  This leads me to believe the SDWan decisions are impacting existing connections.   If I have the "Update Static Route" slider enabled, and a circuit doesn't meet the defined SLA requirement, will it break existing connections by removing the rout

My security team has this compliance requirement."Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters." How would this be configured in FortiGate? 

Hi all, So I am trying to setup Azure Saml for the first time and I am hitting an issue that I cannot seem to find an answer to.    So when using the forticlient I can get to show the microsoft login page but after I enter the user/password I get this. AADSTS700016: Application with identifier '' was not found in the directory ''. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Everything I can find seems to point to the making sure the Azure Application Identifier (Entity ID) and the fortigate Entity-ID match but I have verified it and they do match so not sure what else to look at. Eddie

Dear all, i wanted to improve my multicast traffic enabling IGMP snooping and multicast routing. I am using a Fortigate 40F (7.2.10) together with a Fortiswitch 108F and FortiAP 231G. Before, multicast between my VLANS (ports are on NAC mode) worked perfectly, but now I am lost and I do not know what I am doing wrong... Here some information out of my CLI:  FortiGate40F (settings) # showconfig system settingsset multicast-ttl-notchange enableset gui-multicast-policy enableset gui-dos-policy enableset gui-local-in-policy enableset gui-dynamic-routing enableset gui-advanced-wireless-features enableset gui-email-collection enableset gui-multiple-interface-policy enableFortiGate40F # get switch-controller igmp-snoopingaging-time : 300flood-unknown-multicast: disablequery-interval : 125FortiGate40F # diag switch-controller switch-info igmp-snooping groupS108F***********:IGMP-SNOOPING learned mcast-groups:port VLAN GROUP Age-timeout IGMP-VersionGT40F*** 20 querier 120 V2GT40F*

Hi all, We have a Fortigate 81F.  Also have a Cradlepoint R920 router. I am trying to get the two connected via an ipsec tunnel. The Fortigate has a static public IP, R920 is on a mobile network with CGNAT.  R920 is configured to initiate the connection.  I see there is meant to be an option to set the Fortigate side to passive-mode but that command is not on our Fortigate (FortiOS 7.4) We have other site-to-site vpn connections to this Fortigate, using EdgeRouters but they have static public IPs. The Fortigate reports Phase 1 successful, but then both sides seem to be waiting for the other to respond. Here is an extract from the Fortigate debug log (I've replaced the IP addresses with place-holder names in bold):responder received AUTH msgprocessing notify type INITIAL_CONTACTprocessing notify type EAP_ONLY_AUTHENTICATIONprocessing notify type MESSAGE_ID_SYNC_SUPPORTEDpeer identifier IPV4_ADDR R920PUBLICIPre-validate gw IDgw validation OKauth ve

Currently, I am blacklisting IPs that trigger more than three unauthorized login attempts daily via the local access policy. This is causing issues where valid users are getting locked out and complaining about connectivity. Since switching to IPsec VPN would likely present the same challenge, I am considering whether we need to refine our filtering criteria or policy logic.

Hi Fortinet Community,  Claude AI app is installed on a laptop and when it is launched I see this in the FortiGate logs. How can I check what block it and what should be allowed. Thanks in advance.